acquire icon indicating copy to clipboard operation
acquire copied to clipboard

Skip sparse runs when collecting /var/log/lastlog in acquire

Open DissectBot opened this issue 1 year ago • 2 comments

Similar to how the usnjrnl is collected.

Would no longer be an issue with ASDF.

DissectBot avatar Mar 14 '24 16:03 DissectBot

Can confirm this is still an issue. Encountered various /var/log/lastlog sparse files that the tarfile library apparently can't write to an archive, even when selecting the GNU_FORMAT:

From https://docs.python.org/3/library/tarfile.html

The GNU tar format (GNU_FORMAT). It supports long filenames and linknames, files bigger than 8 GiB and sparse files. It is the de facto standard on GNU/Linux systems. tarfile fully supports the GNU tar extensions for long names, sparse file support is read-only.

Meaning that in our case, some Acquire .tar.gz files expand from ~800MB to ~450GB .tar files, which is not really what we expect and want.

joost-j avatar Aug 08 '25 12:08 joost-j

The long term solution is ASDF.

Schamper avatar Aug 08 '25 12:08 Schamper